CVEvulnerability
CVE-2025-14595
4.3 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-03-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-862
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user with Planner role to view security category metadata and attributes in group security configuration due to improper access control
Affected configurations
• gitlab gitlab (>= 18.6.0 < 18.8.7)
• gitlab gitlab (>= 18.9.0 < 18.9.3)
• gitlab gitlab 18.10.0
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/ Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/583971 Broken Link
- https://hackerone.com/reports/3457779 Permissions Required